DocsICP FilingConsole
Documentation
Home Page Simple Log Service Security and Compliance Use RAM for access control Create a RAM user and grant permissions

Create a RAM user and grant permissions

Updated at:
Copy as MD
Product
My Favorites

A Resource Access Management (RAM) user cannot access Simple Log Service until you grant permissions to the user.

Prerequisites

  • An Alibaba Cloud account. Log on with your Alibaba Cloud account to create a RAM user and grant permissions to the user.

Background information

You might need to delegate the operations and maintenance (O&M) of Simple Log Service to other engineers. Create a RAM user for each engineer, and then grant Simple Log Service permissions to each RAM user.

As a best practice, follow the principle of least privilege and grant a RAM user only the permissions that the user needs. For more information about RAM users, see Overview.

Step 1: Create a RAM user

  1. Log on to the RAM console with your Alibaba Cloud account or as a RAM administrator.

  2. In the left-side navigation pane, choose Identities > Users.

  3. On the Users page, click Create User.

  4. In the User Account Information section of the Create User page, configure the basic information about the user.

    • Logon Name: The logon name can contain letters, digits, periods (.), hyphens (-), and underscores (_), and can be up to 64 characters in length.

    • Display Name: The display name can be up to 128 characters in length.

    • Tag: Click edit and enter a tag key and a tag value. Tags help you manage RAM users by tag.

    Note

    To create multiple RAM users at a time, click Add User.

  5. In the Access Mode section, select an access mode and configure the related parameters.

    For account security, select only one of the following access modes. Keep human users and application users separate.

    • Console Access

      If the RAM user represents a person, enable console access so that the user can access Alibaba Cloud with a username and a logon password. Configure the following parameters:

      • Console logon password: Select an automatically generated password or specify a custom password. A custom password must meet the password complexity requirements. For more information, see Configure a password policy for RAM users.

      • Password reset: Specify whether the RAM user must reset the password at the next logon.

      • Multi-factor authentication (MFA): Specify whether to enable MFA for the RAM user. After MFA is enabled, the Alibaba Cloud account or the RAM user must bind an MFA device to the RAM user. For more information, see Bind an MFA device for a RAM user.

    • OpenAPI Access

      If the RAM user represents an application, enable OpenAPI access so that the application can access Alibaba Cloud with an AccessKey pair. After OpenAPI access is enabled, the system automatically generates an AccessKey ID and an AccessKey secret for the RAM user. For more information, see Create an AccessKey.

      Important

      The AccessKey secret of a RAM user is displayed only when the AccessKey pair is created and cannot be viewed afterward. Keep it secure.

  6. Click OK.

  7. Complete security verification as prompted.

Step 2: Grant permissions to the RAM user

By default, a new RAM user has no permissions. Grant a system policy of Simple Log Service to the RAM user based on the responsibilities of the user:

  • AliyunLogFullAccess — Grants the permissions to manage Simple Log Service. Attach this policy to the engineers who handle the O&M of Simple Log Service.

  • AliyunLogReadOnlyAccess — Grants the read-only permissions on Simple Log Service. Attach this policy to the RAM users who need to access Simple Log Service but do not manage it.

Use either of the following methods to attach the policy to the RAM user.

Method 1: Grant permissions to a RAM user on the RAM Users page

  1. Log on to the RAM console as a RAM administrator.

  2. In the left-side navigation pane, choose Identities > Users.

  3. On the Users page, find the RAM user and click Add Permissions in the Actions column.

    To grant permissions to multiple RAM users at a time, select the RAM users and click Add Permissions below the user list.

  4. In the Grant Permission panel, grant permissions to the RAM user.

    1. Select a resource scope.

      • Account: The permissions take effect within the current Alibaba Cloud account.

      • Resource Group: The permissions take effect within the specified resource group.

        Important

        Permissions granted on a resource group take effect only if the cloud service and resource type support resource groups. For more information, see Services that work with Resource Group. For an example of granting permissions on a resource group, see Control RAM user access to specific ECS instances.

    2. Select principals.

      A principal is the RAM user to which you want to grant permissions. The current RAM user is automatically selected.

    3. Select policies.

      A policy is a set of access permissions. Policies fall into the following two types. You can select multiple policies at a time.

      • System policy: Created by Alibaba Cloud. Alibaba Cloud maintains the policy versions. You can use system policies but cannot modify them. For more information, see Services that support RAM.

        Note

        The system automatically flags high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. Avoid granting unnecessary high-risk policies.

      • Custom policy: Managed by you. You maintain the policy versions and can create, update, and delete custom policies. For more information, see Create a custom policy.

    4. Click Grant permissions.

  5. Click Close.

Method 2: Grant permissions to a RAM user on the authorization page

  1. Log on to the RAM console as a RAM administrator.

  2. In the left-side navigation pane, choose Permissions > Grants.

  3. On the Grants page, click Grant Permission.

  4. In the Grant Permission panel, grant permissions to the RAM user.

    1. Select a resource scope.

      • Account: The permissions take effect within the current Alibaba Cloud account.

      • Resource Group: The permissions take effect within the specified resource group.

        Important

        Permissions granted on a resource group take effect only if the cloud service and resource type support resource groups. For more information, see Services that work with Resource Group. For an example of granting permissions on a resource group, see Control RAM user access to specific ECS instances.

    2. Select principals.

      A principal is the RAM user to which you want to grant permissions. You can select multiple RAM users at a time.

    3. Select policies.

      A policy is a set of access permissions. Policies fall into the following two types. You can select multiple policies at a time.

      • System policy: Created by Alibaba Cloud. Alibaba Cloud maintains the policy versions. You can use system policies but cannot modify them. For more information, see Services that support RAM.

        Note

        The system automatically flags high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. Avoid granting unnecessary high-risk policies.

      • Custom policy: Managed by you. You maintain the policy versions and can create, update, and delete custom policies. For more information, see Create a custom policy.

    4. Click Grant permissions.

  5. Click Close.

Grant fine-grained permissions with a custom policy

If the system policies of Simple Log Service do not meet your requirements, create a custom policy to implement fine-grained permission management. For instructions, see Create a custom policy. For examples of permission policies, see Examples of custom RAM policies and RAM authorization policies for Simple Log Service.

What to do next

After you grant permissions to the RAM user, the user can log on to the console with the credentials of the RAM user and access Simple Log Service. For instructions, see Log on to the Alibaba Cloud Management Console as a RAM user.

Previous：RAM custom policy examplesNext：Use resource groups to restrict project visibility